CySEC License Application: CIF Requirements, Capital, Costs and Timeline

You have the trading tech picked, a payment provider lined up and two markets in mind. Then your consultant sends the CIF file list, and the launch date moves by nine months.

That is the usual shape of a CySEC license application. Not one blocking obstacle, but a long file that has to be complete and internally consistent before anyone at the regulator starts counting days. Most delays are self-inflicted: a director who cannot document experience, a business plan whose revenue model does not match the requested permissions, a website that says things the licence would not allow.

This guide sets out what the application actually asks for. Capital tiers and what triggers them, the people and functions CySEC assesses, the real cost stack, a working timeline, and the public-facing material that gets reviewed alongside the paperwork.

What a CySEC License Is and Who Needs One

A CySEC license is the authorisation that lets a Cyprus Investment Firm (CIF) provide regulated investment services under MiFID II. It is granted by the Cyprus Securities and Exchange Commission, and it attaches to a Cyprus-incorporated company with approved management, capital and systems, not to a brand or a website.

You need one if you plan to do any of the following from Cyprus:

• Receive and transmit client orders in financial instruments

• Execute orders on behalf of clients, including CFD trading

• Deal on own account, which is what most market-making brokers do

• Manage portfolios or give investment advice for a fee

If you touch client orders or client money, you need permission first. There is no build-now-licence-later route that survives supervision.

CIF Categories and the Services They Cover

Your licence is a list of permissions, not a single product. You apply for specific MiFID investment services and specific financial instruments, and CySEC authorises the combination it considers your firm capable of running.

That list drives everything downstream. It sets your capital tier, your reporting duties, and how a CySEC regulated broker may describe itself publicly. Asking for permissions you have no near-term plan to use is a common way to slow a file down, because each one has to be justified in the business plan.

What this means in practice: decide the commercial model before you decide the permissions. A pure agency model that routes orders to a liquidity provider is a materially cheaper licence than a dealing-on-own-account model.

Why Brokers Still Choose Cyprus

Cyprus remains the default EU base for retail brokers because one authorisation reaches the whole single market, with a 12.5% corporate tax rate and a deep local pool of compliance and back-office talent.

The trade-off is honest and worth stating: an offshore licence is faster and cheaper to obtain. A CIF licence costs more, demands real local substance, and puts you inside an EU supervisory regime with continuous reporting. What you buy is distribution and credibility in markets that offshore firms cannot address.

CySEC Application Requirements: The Full Checklist

A CIF application has four components CySEC assesses in parallel: capital, people, systems and documentation. Weakness in any one of them stops the whole file, and the regulator will not progress an application it considers incomplete.

The application pack normally covers:

1. A Cyprus-incorporated company with a share capital structure matching the requested permissions

2. A detailed business plan with three-year financial projections and a defined target market

3. Completed personal questionnaires for every director, shareholder with qualifying holdings and key function holder

4. Organisational charts, staffing plan and outsourcing arrangements

5. Internal manuals: compliance, AML, risk management, internal audit, conflicts of interest, best execution, complaints handling

6. Evidence of paid-up capital held in a Cyprus bank account

7. Client-facing documentation: terms of business, order execution policy, risk disclosures, privacy and key information documents

8. IT and operational resilience arrangements, now assessed against DORA expectations

Corporate Structure, Directors and Local Substance

CySEC expects a company that is actually run from Cyprus. Board practice is at least two executive directors resident on the island plus non-executive members, and every one of them goes through a fit and proper assessment covering experience, reputation, financial soundness and time commitment.

Substance means what it sounds like: a leased office with staff in it, local decision-making, and files that can be inspected. A registered address with a nameplate has not been sufficient for years.

Here is where most applications stall. A director's CV shows seniority but not documented experience in the specific instruments being applied for, and the file goes back for a replacement candidate. That single swap can add two to three months.

Compliance, Risk, Internal Audit and the MLRO

Four control functions must be named, staffed and approved: compliance, risk management, internal audit, and anti-money-laundering, the last led by an AML compliance officer, also called the MLRO.

Internal audit is commonly outsourced to a Cyprus firm. Compliance and AML are increasingly expected to be in-house for firms serving retail clients, and CySEC assesses each holder's qualifications and independence individually.

The takeaway: identify these four people before you file. Sourcing an approvable MLRO under time pressure is one of the most reliable ways to lose a quarter.

How Much Share Capital a CIF Licence Requires

Minimum initial capital is set by activity, not by size: €75,000, €150,000 or €750,000. The tiers come from the EU prudential framework for investment firms, the Investment Firms Regulation and Directive, and which one applies follows directly from your permissions and whether you hold client assets.

Two points founders miss. First, this is a permanent minimum, not a one-time deposit: your own funds must stay at or above the threshold, and capital requirements also scale with fixed overheads and activity volumes once you are trading.

Second, CySEC assesses whether your projected business is fundable at the level you propose. A €150,000 firm forecasting heavy marketing spend and thin revenue in year one will be asked to inject more before approval.

What this means: budget above the legal floor. Firms that capitalise at exactly the minimum often end up topping up mid-application anyway.

CySEC Licence Cost: Capital, Fees and Professional Support

Total CySEC licence cost splits into three buckets: regulatory capital you must hold and keep, one-off application and advisory fees, and recurring supervisory costs that continue for the life of the firm.

Published CySEC fee figures change by circular, so treat any number you read on a consultancy page as indicative and verify it against the current schedule.

The consequence of underbudgeting is specific. Firms that plan only for capital and legal fees tend to run short in month eight, exactly when the regulator asks for additional information and the file needs paid professional attention. Compare this against what a brokerage website costs and the rest of your launch stack before you commit to a tier.

How Long the CySEC Application Takes

CySEC must decide within six months of receiving a complete application, a deadline set by the MiFID II authorisation procedure in the ESMA single rulebook. In practice, most firms should plan for 9 to 12 months from incorporation to activation, because the clock only runs on a file the regulator considers complete.

A realistic sequence looks like this:

1. Preparation, 2 to 4 months. Company incorporation, capital deposited, directors and function holders identified, business plan and manuals drafted.

2. Filing. The pack goes in with all questionnaires and supporting evidence.

3. Completeness review, 1 to 2 months. CySEC checks the file is whole. Gaps here reset your effective start date.

4. Substantive review with information rounds, 4 to 8 months. Questions on the business model, personnel, capital adequacy and policies. Response speed on your side is the main variable.

5. Approval and activation, 1 to 2 months. Conditions cleared, ICF membership, final operational readiness, then trading permissions go live.

This is why the timeline matters commercially. Every month of review is a month of office rent, salaries for approved officers and no revenue. Firms that prepare the file, the manuals and the public-facing material in parallel routinely reach activation a full quarter ahead of firms that treat each as a separate phase.

MiFID II Passporting: What a CySEC Licence Unlocks

Unlike an offshore authorisation, a CIF licence passports: one approval covers cross-border services and branches across the European Economic Area, through regulator notification rather than a fresh application in each country.

That means:

• You can serve clients in other EEA states under your Cyprus permissions

• You can open a branch in another member state on a notification basis

• Your firm appears in EU-level registers, which matters to banks, payment providers and liquidity partners

The limits are real too. MiFID II passporting does not exempt you from local marketing and conduct rules, and product intervention measures still bite: ESMA's CFD measures set leverage caps, negative balance protection and standardised risk warnings that shape how you can promote to retail clients anywhere in the bloc.

Where the Website Fits Into the CIF Application

CySEC reviews the firm's public-facing material, so the website belongs in the application file rather than the post-launch backlog. Your pages state who is authorised, under what number, for which clients and with what warnings, and every one of those statements has to match the permissions you were granted.

What a reviewer looks for on a regulated broker site:

• Full legal entity name, registration and licence number, and registered address

• Which entity serves which jurisdictions, and which countries are excluded

• Risk warnings and the loss-percentage statement in the required prominence

• Client documentation reachable before account opening: terms, execution policy, complaints procedure

• No performance promises, guaranteed-return language or unqualified comparative claims

In WSA's work with regulated brokers, the pattern is consistent: firms that treat disclosure as a design system get through review cleanly, and firms that bolt warnings onto finished pages rewrite them twice. Entity footers, jurisdiction gating and risk-warning bars belong in the component library, which is why we build these sites in Framer, where a single component change propagates across every page.

For the page-level detail, WSA has covered CySEC website requirements and whether the site has to exist before you file separately, plus a cross-regulator broker website compliance checklist. If you are still comparing regimes, our guide to forex brokerage licence options sets Cyprus against the alternatives.

What this means: a CySEC license application with website included as part of the same workstream is not gold-plating. It removes a predictable source of review comments and lets you launch marketing the week permissions go live.

Conclusion

A CySEC license is won on file quality, not ambition. Get the permissions list right, capitalise above the floor for your tier, name approvable directors and control-function holders early, and answer information requests fast. Do that and the six-month statutory window becomes achievable rather than theoretical.

Treat the public-facing side as part of the same project. The CIF licence Cyprus grants you, plus MiFID II passporting, only turns into revenue when there is a site ready to convert regulated-market traffic on day one.

WSA designs and builds websites for brokers and fintech firms working inside exactly these constraints, usually in weeks. If you are preparing an application, start your project with WSA and have the site ready when your permissions are.

Figures and requirements in this article describe the framework as it stands and should be confirmed against current CySEC circulars and with a Cyprus-licensed adviser. This is not legal advice.

FAQ

How much share capital does a CySEC CIF licence require?

Between €75,000 and €750,000, depending on the services you are authorised to provide. Under the EU Investment Firms Regulation framework applied by CySEC, €75,000 covers firms that receive and transmit orders, execute, manage portfolios or advise without holding client money or financial instruments. €150,000 applies where the firm holds client money or instruments but does not deal on own account, which is the typical straight-through-processing broker. €750,000 applies to firms dealing on own account or underwriting on a firm-commitment basis, which covers most market-making CFD brokers.

The figure is a permanent minimum rather than a deposit. Own funds must remain at or above the threshold, and the requirement rises with your fixed overheads and activity once trading begins. CySEC also assesses whether the amount is realistic for your projected business, so firms capitalised at exactly the floor are frequently asked to inject more before approval. Confirm current thresholds and any firm-specific add-ons with a Cyprus-licensed adviser before you fund the account.

How long does CySEC take to approve an application?

CySEC must notify the applicant of its decision within six months of receiving a complete application. That word matters: the six-month clock starts when the regulator considers the file whole, not when you first submit it.

Most firms should plan for 9 to 12 months from incorporation to live trading permissions. A typical path is 2 to 4 months of preparation, 1 to 2 months of completeness review, 4 to 8 months of substantive review including one or more rounds of additional questions, then 1 to 2 months to clear conditions and activate.

The main variable is you. Files with documented, approvable directors and function holders, a business plan consistent with the requested permissions, and fast responses to information requests move materially quicker than files that need a replacement candidate or a revised model mid-review.

Can a CySEC licence be passported across the EU?

Yes. A CIF licence carries MiFID II passporting rights, so a single Cyprus authorisation lets you provide the same investment services in any European Economic Area state, either cross-border or through a branch, using a regulator-to-regulator notification instead of a new application.

Passporting covers your permissions, not local conduct rules. Marketing restrictions, language requirements and complaints handling still follow the host state, and EU-wide product intervention measures on CFDs continue to apply: leverage limits by asset class, negative balance protection, a ban on trading incentives, and a standardised risk warning showing the percentage of loss-making retail accounts.

This passport is the main commercial argument for Cyprus over an offshore jurisdiction. One licence, one supervisory relationship, access to the whole single market, and a status that banks and payment providers recognise.

Do I need a physical Cyprus office and local directors?

Yes. CySEC expects genuine local substance: a leased office in Cyprus with staff working in it, and management actually exercised from the island.

In practice that means at least two executive directors resident in Cyprus alongside non-executive members, so the board satisfies the four-eyes principle, plus named holders for compliance, risk management, internal audit and anti-money-laundering. Each individual is assessed as fit and proper on experience, reputation, financial soundness and available time. Internal audit is commonly outsourced to a Cyprus firm; compliance and AML are increasingly expected in-house for retail-facing brokers.

A registered address with no operations behind it does not pass. Supervisors visit, request records and expect decisions to be documented locally, so budget for real premises and local salaries from the month you incorporate rather than from the month you are approved.

Must my website be ready before I file the CIF application?

Not fully built, but not ignored either. CySEC reviews client-facing documentation and public material as part of assessing how you will treat clients, so your disclosures, terms, risk warnings and the claims you intend to make should be settled while the file is being prepared.

The practical approach is to design the disclosure architecture early and finish the marketing build in parallel with the review. Entity name and licence number, jurisdiction restrictions, the loss-percentage risk warning, and access to terms and execution policy before account opening all need defined places in the layout.

Firms that leave this to the end usually rewrite pages twice: once to match the permissions actually granted, once to fix prominence. Firms that treat warnings and entity details as reusable components launch marketing the same week their permissions go live.